Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
24/06/2024, 07:42
General
- Target 073fc523c75f0486058e19e9d269b3d9_JaffaCakes118.exe
- Size 805KB
- Sample240624-jj264avbpl
- SHA256 0dd843a1b1e201bb9a82ac91015813281bf4c6307717759234af16bedff6b3d9
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 4 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\073fc523c75f0486058e19e9d269b3d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\073fc523c75f0486058e19e9d269b3d9_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ssmss.exeC:\Windows\system32\ssmss.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Deleteme.bat
ssmss.exe
memory/1580-10-0x0000000000400000-0x00000000005DB000-memory.dmp
memory/1580-13-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/1580-16-0x0000000000400000-0x00000000005DB000-memory.dmp
memory/2796-0-0x0000000000400000-0x00000000005DB000-memory.dmp
memory/2796-2-0x0000000000400000-0x00000000005DB000-memory.dmp
memory/2796-4-0x0000000002240000-0x0000000002241000-memory.dmp
memory/2796-17-0x0000000000400000-0x00000000005DB000-memory.dmp